Pay2Key SFX Dropper Self-Deletion via fsutil Zero and ping Delay

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects a suspicious self-deletion pattern associated with the Pay2Key ransomware, where an SFX dropper uses cmd.exe to execute a ping-based delay followed by fsutil to zero out the original dropper file, and subsequently performs mass deletion of remaining .exe and .bat files.